Input Configuration

Case-Hub Input Configuration

Inputs control how the Case-Hub collects event data from the configured backend. Inputs are consumed by Agents, which then are tasked with polling that Input for data and processing it into a format the Case-Hub API can understand.

Creating Inputs

Prior to creating a new input, create credentials for the input and then follow the below steps to create an Input:

1. Navigate to the System -> Inputs page from the Dashboard, Click "New Input"

2. Provide required backend configuration details for the input, starting with an appropriate Input Name, Description, and Tags.

3. Select the plugin "ElasticSearch" you want to configure, check Plugin Configuration

4. Select the credentials this input should use to connect to the configured plugin.

5. Plugin Configuration - Provide the configuration for Elasticsearch like Distro, Index to query, HTTP Auth Method.

6. Event Base Configuration - Add the relevant event fields like Title, Description, Severity, Tags, and others.

7. Additional Configuration - Add all the relevant Field Mappings.

8. Select the SIGMA Pipeline, and MITRE data sources that apply.

9. Review - Confirm the input configurations, click Create

Plugin Configuration

In order for the Input plugin to properly work, it should be properly configured.

ElasticSearch

When configuring your Input, this section of configuration will tell Case-Hub how to interact with Elasticsearch.

Elastic-Search Fields	Description
Elasticsearch Hosts	Provide the address of the Elasticsearch host (e.g.,https://localhost:9200)
Distro	Select the distro (distributed version) of Elasticsearch to use
Alert Index	Index where Case-Hub should look for Events
Lucene Filter	Use it to filter what Events are to be pulled into Case-Hub
HTTP Scheme	Choice to connect to Elasticsearch over HTTP or HTTPS
Auth Method	Choose how to Authenticate with Elasticsearch - Elastic API key or Basic Authentication
CA Cert Path	Path to your clusters certificate authority (CA) public certificate
Verify Hostname	Option to verify the hostname
TLS Verification Mode	TLS Mode will use for verification

Event Base Configuration

This section of configuration determines what data is included in an Event shipped by an Agent.

Event Base Configuration	Description
Event Title Field	Title of the Events as they will appear in the Event Queue
Description Field	Description to be extracted for the Event
Reference Field	Defines a field that will provide a unique value each Event
Severity Field	The field that determines the severity of the Event on a scale of 1-4
Original Date Field	Preserves the original time the alert was generated
Tag Fields	Fields to derive tags from that will appear on the side of an Event card
Signature Fields	A single field or a combination of fields is used to compute an Event's signature.
Search Size	Define the number of Events to return by the agent on each poll
Search Period	Determines how far back in time to go in the source index
Static Tags	Tags that will always be applied to these Events

Additional Configuration

Field Mappings

Field mappings determine how source data is mapped to a particular data type in the Case-Hub. This process involves extracting relevant information that will be displayed as Observables on Event cards on the Event-Queue page. For instance, if you map an IP address to the IP data type, you can perform CIDR notation checks using RQL.

Sigma Configuration (Beta)

By providing Sigma configurations, Detections can automatically convert Sigma rules that use this input to the target pipeline and backend. The selected values can be overridden during the Sigma to Detection conversion process.

MITRE Configuration (Beta)

Data sources allow you to define what specific data sources (logs) will be provided for this input when aligned with the MITRE ATT&CK framework of attack techniques and tactics. By utilizing these data sources, Detections can automatically recommend other Detections that require specific data sources.